ash_phoenix CVE-2026-82725

The attacker must hold at least a low-privilege authenticated session (PR:L per CVSS 4.0 vector). The target application must use AshPhoenix.FilterForm to expose filter functionality on an Ash resource that defines one or more relationships marked non-public (public?: false or omitted). The attacker supplies crafted path or field form parameters referencing those private relationship names. Exploitation is limited to a confidentiality oracle - no write access or denial-of-service capability is obtained. Applications not using AshPhoenix.FilterForm, or whose resources define no private relationships accessible via filter forms, are not affected. The CVSS 4.0 AT:P metric confirms that specific deployment conditions (FilterForm usage with private relationships) are required, limiting exposure beyond authenticated access alone.

The CVSS 4.0 score of 2.3 (Low) accurately reflects the constrained impact: only confidentiality is affected (VC:L), with no integrity or availability impact. The AT:P metric captures a genuine deployment precondition - the application must use AshPhoenix.FilterForm and define private relationships in its Ash resource schema. Authentication is required (PR:L), so unauthenticated users cannot exploit this. No CISA KEV listing and no public proof-of-concept reduce urgency further. Practical impact is a boolean oracle: attackers learn whether private related records exist but do not obtain field values directly, limiting information disclosure severity. Risk is highest in applications where private relationships encode sensitive associations (e.g., billing linkages, role mappings, restricted user relationships) that could be enumerated through repeated filter probing. EPSS score is absent from input data, so exploitation probability cannot be quantified independently. The low CVSS score and AT:P requirement together suggest this is a real but narrow-impact issue warranting a routine patch cycle rather than emergency response.

An authenticated application user submits a filter form request with the path parameter set to a private Ash relationship name - for example, path=author where author carries public?: false. By toggling the filter value and observing whether the response returns rows or an empty result set, the attacker builds a binary oracle to determine whether matching private related records exist, and repeats across different values to enumerate private relational data. No public proof-of-concept has been identified at time of analysis; the attack requires only standard HTTP form interaction from an authenticated session.